FltFlushBuffers in 2003 server

Hi, everyone,

I have a problem with flushing file buffer on 2003 server.

My mini filter creates thread on PASSIVE_LEVEL.
It reads data from file to buffer and writes it back to the file.
My read/write callbacks encrypt data (for non buffered IO). For
encrypting data I call User Mode service.
It works nice, but…

The problem is following. Function FltFlushBuffers return
STATUS_FLT_INTERNAL_ERROR.
So ZwWriteFile writes only into file cache, not into real file.
Some later (in several minutes) I really get calls for non buffered IO.
But if I reboot system, my user mode service is shutting down earlier of
flushing buffers, so my data become corrupted.

What is the reason of internal error in FltFlushBuffers ?
and
Is there a way to enforce flushing ?

Thanks
Valery

Do you not use non-buffered IO to write the data back to the file ? Why not ?

Thanks,
Alex.
On Feb 14, 2013, at 8:36 AM, Valery Druba wrote:

> Hi, everyone,
>
> I have a problem with flushing file buffer on 2003 server.
>
> My mini filter creates thread on PASSIVE_LEVEL.
> It reads data from file to buffer and writes it back to the file.
> My read/write callbacks encrypt data (for non buffered IO). For encrypting data I call User Mode service.
> It works nice, but…
>
> The problem is following. Function FltFlushBuffers return STATUS_FLT_INTERNAL_ERROR.
> So ZwWriteFile writes only into file cache, not into real file.
> Some later (in several minutes) I really get calls for non buffered IO.
> But if I reboot system, my user mode service is shutting down earlier of flushing buffers, so my data become corrupted.
>
> What is the reason of internal error in FltFlushBuffers ?
> and
> Is there a way to enforce flushing ?
>
> Thanks
> Valery
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

I get only buffered IO.
Non-buffered come only on flushing, in several minutes.

Regards
Valery

14.02.2013 20:41, Alex Carp пишет:

Do you not use non-buffered IO to write the data back to the file ? Why not ?

Thanks,
Alex.
On Feb 14, 2013, at 8:36 AM, Valery Druba wrote:
>
>> Hi, everyone,
>>
>> I have a problem with flushing file buffer on 2003 server.
>>
>> My mini filter creates thread on PASSIVE_LEVEL.
>> It reads data from file to buffer and writes it back to the file.
>> My read/write callbacks encrypt data (for non buffered IO). For encrypting data I call User Mode service.
>> It works nice, but…
>>
>> The problem is following. Function FltFlushBuffers return STATUS_FLT_INTERNAL_ERROR.
>> So ZwWriteFile writes only into file cache, not into real file.
>> Some later (in several minutes) I really get calls for non buffered IO.
>> But if I reboot system, my user mode service is shutting down earlier of flushing buffers, so my data become corrupted.
>>
>> What is the reason of internal error in FltFlushBuffers ?
>> and
>> Is there a way to enforce flushing ?
>>
>> Thanks
>> Valery
>>
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Valery,

I think Alex is asking why don’t you perform non-cached IO when you
write the buffer back to the file? If you are encrypting it prior to the
write then just perform non-cached IO which would eliminate this window
and the need to perform the flush.

Pete

On 2/14/2013 11:02 AM, Valery Druba wrote:

I get only buffered IO.
Non-buffered come only on flushing, in several minutes.

Regards
Valery

14.02.2013 20:41, Alex Carp пишет:
> Do you not use non-buffered IO to write the data back to the file ?
> Why not ?
>
> Thanks,
> Alex.
> On Feb 14, 2013, at 8:36 AM, Valery Druba
>> wrote:
>>
>>> Hi, everyone,
>>>
>>> I have a problem with flushing file buffer on 2003 server.
>>>
>>> My mini filter creates thread on PASSIVE_LEVEL.
>>> It reads data from file to buffer and writes it back to the file.
>>> My read/write callbacks encrypt data (for non buffered IO). For
>>> encrypting data I call User Mode service.
>>> It works nice, but…
>>>
>>> The problem is following. Function FltFlushBuffers return
>>> STATUS_FLT_INTERNAL_ERROR.
>>> So ZwWriteFile writes only into file cache, not into real file.
>>> Some later (in several minutes) I really get calls for non buffered IO.
>>> But if I reboot system, my user mode service is shutting down earlier
>>> of flushing buffers, so my data become corrupted.
>>>
>>> What is the reason of internal error in FltFlushBuffers ?
>>> and
>>> Is there a way to enforce flushing ?
>>>
>>> Thanks
>>> Valery
>>>
>>>
>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> OSR is hiring!! Info at http://www.osr.com/careers
>>>
>>> For our schedule of debugging and file system seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

Alex, Pete,

Sorry, I did not understand you previous time.
I don’t use FILE_NO_INTERMEDIATE_BUFFERING on ZwCreateFile, because it
is incompatible with the /DesiredAccess/ parameter’s FILE_APPEND_DATA//flag.
But I need this flag, because I add some specific hidden information
into encrypted file.

Regards
Valery

14.02.2013 22:11, Peter Scott пишет:

Valery,

I think Alex is asking why don’t you perform non-cached IO when you
write the buffer back to the file? If you are encrypting it prior to
the write then just perform non-cached IO which would eliminate this
window and the need to perform the flush.

Pete

On 2/14/2013 11:02 AM, Valery Druba wrote:
> I get only buffered IO.
> Non-buffered come only on flushing, in several minutes.
>
> Regards
> Valery
>
> 14.02.2013 20:41, Alex Carp пишет:
>> Do you not use non-buffered IO to write the data back to the file ?
>> Why not ?
>>
>> Thanks,
>> Alex.
>> On Feb 14, 2013, at 8:36 AM, Valery Druba
>>> wrote:
>>>
>>>> Hi, everyone,
>>>>
>>>> I have a problem with flushing file buffer on 2003 server.
>>>>
>>>> My mini filter creates thread on PASSIVE_LEVEL.
>>>> It reads data from file to buffer and writes it back to the file.
>>>> My read/write callbacks encrypt data (for non buffered IO). For
>>>> encrypting data I call User Mode service.
>>>> It works nice, but…
>>>>
>>>> The problem is following. Function FltFlushBuffers return
>>>> STATUS_FLT_INTERNAL_ERROR.
>>>> So ZwWriteFile writes only into file cache, not into real file.
>>>> Some later (in several minutes) I really get calls for non buffered
>>>> IO.
>>>> But if I reboot system, my user mode service is shutting down earlier
>>>> of flushing buffers, so my data become corrupted.
>>>>
>>>> What is the reason of internal error in FltFlushBuffers ?
>>>> and
>>>> Is there a way to enforce flushing ?
>>>>
>>>> Thanks
>>>> Valery
>>>>
>>>>
>>>>
>>>>
>>>> —
>>>> NTFSD is sponsored by OSR
>>>>
>>>> OSR is hiring!! Info at http://www.osr.com/careers
>>>>
>>>> For our schedule of debugging and file system seminars visit:
>>>> http://www.osr.com/seminars
>>>>
>>>> To unsubscribe, visit the List Server section of OSR Online at
>>>> http://www.osronline.com/page.cfm?name=ListServer
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> OSR is hiring!! Info at http://www.osr.com/careers
>>>
>>> For our schedule of debugging and file system seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>

I think maybe you don?t understand what FILE_NO_INTERMEDATE_BUFFERING does.

When this option is specified, subsequent I/O operations are always constructed by the I/O Manager with the IRP_NO_CACHE bit set in the Irp->Flags field.

What they were suggesting is that rather than set this for the file, you could just do it for a single I/O operation:

FltWriteFile has an option flag - FLTFL_IO_OPERATION_NON_CACHED ? that will cause the I/O Manager to issue an IRP with the IRP_NO_CACHE bit. But it doesn?t impact the open of the file ? only the performance of that single I/O operation.

Tony
OSR